CVE-2026-53793

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0

Description A path confinement bypass allows remote clients to escape the intended inner-module root confinement. This occurs when the module root contains a /./ boundary marker, enabling the construction of paths that resolve outside the chroot boundary. Attackers can exploit the improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to obtain unauthorized read or write access to files outside the module's subtree.

Recommendations Update rsync to version 3.5.0 or later.